Merge branch 'master' into chore/remove-commons-lang-2.6

Author: alecharp

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,3 +1,12 @@
+<!-- Comment:
+!!! ⚠️ IMPORTANT ⚠️ !!!
+Do not remove any of the sections below, even if they are not applicable to your change. The sections are used by the
+changelog generator and other tools to extract information about the change. If a section is not applicable,
+leave as is. Carefully read the instructions in each section and provide the necessary information.
+
+Pull requests that do not follow the template might be closed without further review.
+-->
+
 <!-- Comment:
 A great PR typically begins with the line below.
 Replace <issue-number> with the issue number.

ath.sh

@@ -6,7 +6,7 @@ set -o xtrace
 cd "$(dirname "$0")"
 
 # https://github.com/jenkinsci/acceptance-test-harness/releases
-export ATH_VERSION=6536.vedb_8c398315e
+export ATH_VERSION=6578.vcd7330d974d1
 
 if [[ $# -eq 0 ]]; then
 	export JDK=21

bom/pom.xml

@@ -38,10 +38,10 @@ THE SOFTWARE.
   <description>The module contains dependencies that are used by a specific Jenkins version</description>
 
   <properties>
-    <commons-fileupload2.version>2.0.0-M4</commons-fileupload2.version>
+    <commons-fileupload2.version>2.0.0-M5</commons-fileupload2.version>
     <groovy.version>2.4.21</groovy.version>
     <jelly.version>1.1-jenkins-20250731</jelly.version>
-    <stapler.version>2074.v6ff4fa_fccff7</stapler.version>
+    <stapler.version>2076.v1b_a_c12445eb_e</stapler.version>
   </properties>
 
   <dependencyManagement>
@@ -63,15 +63,15 @@ THE SOFTWARE.
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>6.2.15</version>
+        <version>6.2.16</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
       <dependency>
         <!-- https://docs.spring.io/spring-security/reference/6.3/getting-spring-security.html#getting-maven-no-boot -->
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-bom</artifactId>
-        <version>6.5.7</version>
+        <version>6.5.8</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>

core/src/main/java/hudson/cli/BuildCommand.java

@@ -221,21 +221,7 @@ protected int run() throws Exception {
 
     @Override
     protected void printUsageSummary(PrintStream stderr) {
-        stderr.println(
-                """
-                Starts a build, and optionally waits for a completion.
-                Aside from general scripting use, this command can be
-                used to invoke another job from within a build of one job.
-                With the -s option, this command changes the exit code based on
-                the outcome of the build (exit code 0 indicates a success)
-                and interrupting the command will interrupt the job.
-                With the -f option, this command changes the exit code based on
-                the outcome of the build (exit code 0 indicates a success)
-                however, unlike -s, interrupting the command will not interrupt
-                the job (exit code 125 indicates the command was interrupted).
-                With the -c option, a build will only run if there has been
-                an SCM change."""
-        );
+        stderr.println(Messages.BuildCommand_PrintUsageSummary());
     }
 
     public static class CLICause extends UserIdCause {

core/src/main/java/hudson/model/Cause.java

@@ -199,6 +199,11 @@ private UpstreamCause(String upstreamProject, int upstreamBuild, String upstream
             this.upstreamCauses = upstreamCauses;
         }
 
+        @Override
+        public void onLoad(@NonNull Run<?, ?> build) {
+            onLoad(build.getParent(), build.getNumber());
+        }
+
         @Override
         public void onLoad(@NonNull Job<?, ?> _job, int _buildNumber) {
             Item i = Jenkins.get().getItemByFullName(this.upstreamProject);

core/src/main/java/hudson/model/ManagementLink.java

@@ -174,6 +174,12 @@ public enum Category {
          * Configuration pages that don't fit into a more specific section.
          */
         CONFIGURATION(Messages._ManagementLink_Category_CONFIGURATION()),
+        /**
+         * Configuration pages related to plugin management, including installation,
+         * updates, and administrative actions for maintaining installed plugins.
+         */
+        @Restricted(NoExternalUse.class)
+        PLUGINS(Messages._ManagementLink_Category_PLUGINS()),
         /**
          * Security related options. Useful for plugins providing security related {@code ManagementLink}s (e.g. security realms).
          * Use {@link Category#STATUS} instead if the feature is informational.

core/src/main/java/hudson/model/RunParameterValue.java

@@ -28,11 +28,13 @@
 import hudson.EnvVars;
 import java.util.Locale;
 import jenkins.model.Jenkins;
+import jenkins.util.SystemProperties;
 import org.kohsuke.stapler.DataBoundConstructor;
 import org.kohsuke.stapler.export.Exported;
 
 public class RunParameterValue extends ParameterValue {
 
+    private static /* non-final for Script console */ boolean SKIP_EXISTENCE_CHECK = SystemProperties.getBoolean(RunParameterValue.class.getName() + ".SKIP_EXISTENCE_CHECK", false);
     private final String runId;
 
     @DataBoundConstructor
@@ -49,9 +51,19 @@ public RunParameterValue(String name, String runId) {
     private static String check(String runId) {
         if (runId == null || runId.indexOf('#') == -1) {
             throw new IllegalArgumentException(runId);
-        } else {
-            return runId;
         }
+
+        if (!SKIP_EXISTENCE_CHECK) {
+            try {
+                if (Run.fromExternalizableId(runId) == null) {
+                    throw new IllegalArgumentException(runId);
+                }
+            } catch (RuntimeException e) {
+                throw new IllegalArgumentException(runId);
+            }
+        }
+
+        return runId;
     }
 
     /**

core/src/main/java/hudson/slaves/OfflineCause.java

@@ -26,6 +26,7 @@
 
 import edu.umd.cs.findbugs.annotations.CheckForNull;
 import edu.umd.cs.findbugs.annotations.NonNull;
+import hudson.Util;
 import hudson.model.Computer;
 import hudson.model.User;
 import java.io.ObjectStreamException;
@@ -166,7 +167,7 @@ public User getUser() {
          * @return the message that was provided when the computer was taken offline
          */
         public String getMessage() {
-            return message;
+            return Util.escape(message);
         }
 
         // Storing the User in a filed was a mistake, switch to userId
@@ -202,6 +203,11 @@ public String getComputerIconAltText() {
         public String getIcon() {
             return "symbol-person";
         }
+
+        @Override
+        public String toString() {
+            return Util.escape(super.toString());
+        }
     }
 
     public static class ByCLI extends UserCause {

core/src/main/java/hudson/tools/AbstractCommandInstaller.java

@@ -72,8 +72,9 @@ public String getToolHome() {
     @Override
     public FilePath performInstallation(ToolInstallation tool, Node node, TaskListener log) throws IOException, InterruptedException {
         FilePath dir = preferredLocation(tool, node);
+        dir.mkdirs();
         // TODO support Unix scripts with interpreter line (see Shell.buildCommandLine)
-        FilePath script = dir.createTextTempFile("hudson", getCommandFileExtension(), command);
+        FilePath script = dir.createTextTempFile("hudson", getCommandFileExtension(), command, false);
         try {
             String[] cmd = getCommandCall(script);
             int r = node.createLauncher(log).launch().cmds(cmd).stdout(log).pwd(dir).join();

core/src/main/java/hudson/util/HttpResponses.java

@@ -56,7 +56,7 @@ public static HttpResponse staticResource(File f) throws IOException {
      * Redirect to the given URL via a client-side JS/meta tag redirect.
      * @param url the URL to redirect to
      * @return the HttpResponse
-     * @since TODO
+     * @since 2.550
      */
     public static HttpResponse clientRedirectTo(String url) {
         return new ClientHttpRedirect(url);